---
id: "CVE-2026-115701"
page: "https://infrastack.ai/live/CVE-2026-115701"
kind: "vulnerability"
aliases: ["CVE-2026-115701"]
title: "Cowboy: unbounded buffering during open requests lets remote clients exhaust memory"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "cowboy", "fixed": [], "affected": ">= 2.18.0", "ecosystem": "hex"}]
ecosystems: []
tags: ["cowboy", "elixir", "erlang", "http-server", "package"]
not_affected_if: ["cowboy-below-2.18.0", "http2-only", "short-handlers-only"]
published_at: "2026-11-06T11:17:05+00:00"
first_seen_at: "2026-11-06T11:41:23+00:00"
updated_at: "2026-11-06T11:43:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115701", "first_seen_at": "2026-11-06T11:41:23+00:00"}, {"source": "analyst", "url": "https://cna.erlef.org/cves/CVE-2026-115701.html", "first_seen_at": "2026-11-06T11:43:40+00:00", "cites": ["https://cna.erlef.org/cves/CVE-2026-115701.html", "https://hex.pm/packages/cowboy/advisories"]}]
exploit_sources: []
---

# Cowboy: unbounded buffering during open requests lets remote clients exhaust memory

Link for people: https://infrastack.ai/live/CVE-2026-115701 (this .md is for agents)

While a request handler is still running, Cowboy keeps appending every byte a client sends on a keep-alive HTTP/1.1 connection to an unlimited buffer. A remote, unauthenticated attacker using a few connections can drive the Erlang VM into out-of-memory conditions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- hex:cowboy affected >= 2.18.0 fixed no fixed version listed

## How to check

- Find cowboy in rebar.lock or mix.lock; versions 2.18.0 and later (including 2.19.0, which predates the fix) are affected unless built from a commit including 3a630c0
- Versions up to 2.17.0 are not affected (they answer 414 immediately)
- Exposure is highest where HTTP/1.1 handlers hold requests open (cowboy_loop long polling, stream_reply, slow backend calls); HTTP/2 is not affected

## Fix

No fixed release named by the advisory. Fix is commit 3a630c07e1521abf63a1b9ea080509aa1337b60d (stops reading pipelined data while a request is in progress; re-sets socket to passive). Until a release containing it ships, pin to that commit or stay on cowboy 2.17.0 or earlier (not affected per advisory).

## Timeline

- 2026-11-06T11:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115701
- 2026-11-06T11:43:40+00:00 analyst https://cna.erlef.org/cves/CVE-2026-115701.html — Read EEF CNA advisory (primary, CNA for cowboy) + fix commit 3a630c0. Affected >=2.18.0 (bug from removal of concurrent pipelined processing); 2.16.1/2.17.0 answer 414. No released fixed version named: latest tag seen is 2.19.0 (Sep 8, before disclosure) and Hex lists >=2.18.0 with no upper bound, so 2.19.0 presumably still affected; unconfirmed. HTTP/2 not affected. No exploitation or public PoC link beyond advisory steps.

## Documents

- [advisory] EEF CNA: CVE-2026-115701 Cowboy HTTP/1.1 unbounded buffering https://cna.erlef.org/cves/CVE-2026-115701.html
- [advisory] Hex.pm security advisories for cowboy https://hex.pm/packages/cowboy/advisories
- [fix] Patch: github.com https://github.com/ninenines/cowboy/commit/3a630c07e1521abf63a1b9ea080509aa1337b60d
- [fix] Patch: github.com https://github.com/ninenines/cowboy/commit/faf5594fbf74530ace90b0c46c936bdc2cf82081

## From the sources

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1.

Once a request has been received in full and its handler is still running, cowboy_http:parse/2 in src/cowboy_http.erl appends every further byte that arrives on the keep-alive connection to the connection buffer and returns to the receive loop without parsing it. The socket stays in active mode and no limit applies to this buffer: max_request_line_length, max_headers and the other parser limits only take effect once the handler returns and parsing resumes, and the only timer in this state is idle_timeout (default 60 seconds), which is reset on every received chunk. A client can therefore send an arbitrary amount of data on one connection for as long as the handler runs, and a few connections to an endpoint that holds requests open can drive the Erlang VM into out-of-memory conditions.

This issue affects cowboy: from 2.18.0 onward.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_